Virtualization with SUSE Linux Enterprise 11 SP2 Lecture

Transcription

1 Virtualization with SUSE Linux Enterprise 11 SP2 Lecture SUS01/SUS02 Novell Training Services ATT LIVE 2012 LAS VEGAS

2 Legal Notices Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc., reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. Further, Novell, Inc., makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc., reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to notify any person or entity of such changes. Any products or technical information provided under this Agreement may be subject to U.S. export controls and the trade laws of other countries. You agree to comply with all export control regulations and to obtain any required licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. See the Novell International Trade Services Web page ( for more information on exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export approvals. Copyright 2012 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrieval system, or transmitted without the express written consent of the publisher. Novell, Inc., has intellectual property rights relating to technology embodied in the product that is described in this document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S. patents listed on the Novell Legal Patents Web page ( and one or more additional patents or pending patent applications in the U.S. and in other countries. Novell, Inc. 404 Wyman Street, Suite 500 Waltham, MA U.S.A. Online Documentation: To access the latest online documentation for this and other Novell products, see the Novell Documentation Web page ( Novell Trademarks For Novell trademarks, see the Novell Trademark and Service Mark list ( Third-Party Materials All third-party trademarks are the property of their respective owners. 2 Copying all or part of this manual, or distributing such copies, is strictly prohibited. To report suspected copying, please call PIRATES. Version 1

3 Contents SECTION 1: Introduction to KVM Virtualization 4 SECTION 2: Introduction to Virtual Machines 35 SECTION 3: Introduction to Open Source Virtualization Management 44 SECTION 4: Manage Virtualization Platforms with Libvirt 68 SECTION 5: Pause, Save and Automatically Boot KVM VMs 103 SECTION 6: Delegate Virtualization Administration 119 SECTION 7: Manage Virtual Networks with Libvirt 138 SECTION 8: Work with Virtual Hardware in KVM 156

4 Advancements in Virtualization with SUSE Linux Enterprise 11 SP2 SUS01: KVM Section 1: Introduction to Virtualization with KVM 4

5 Objectives KVM Terminology KVM Virtualization Architecture Virtualization Modes CPU Virtualization Introduction to KVM Hardware Virtualization KVM Feature and OS Support 5

6 KVM Terminology Objective 1 6

7 Community Terminology Domain: A container for a running virtual machine. Colloquially, the virtual machine (VM) itself Physical Driver: A device driver that talks directly to the hardware Virtual Driver: A device driver in a VM that fulfills requests by going to the physical driver in the vhost 7

8 KVM Virtualization Architecture Objective 1 8

9 KVM Virtualization Architecture Virtual Machine Layer Applications Applications Virtualization Layer vhost VM Management (libvirt) Hypervisor Management (qemu-kvm) Virtualized Hardware (qemu-dm/virtio) IO System Virtual Driver Virtual Driver Kernel IO System Virtual Driver Virtual Driver Kernel Physical Drivers IO Path KVM Hypervisor Kernel Module Linux OS Kernel / Host OS Hardware Layer Physical Hardware IO & Platform Devices (Disk, LAN, USB, BMC, IPMI, ACPI, etc.) Memory & CPU (x86, x86-64, EM64T) With KVM (or the Kernel Virtual Machine), a kernel module is loaded into the Linux kernel that turns it into a hypervisor. KVM would essentially be a Type I Hypervisor because it is running directly on top of the hardware. With KVM, the Linux kernel becomes a fat hypervisor because it not only mediates access to the underlying hardware but also loads physical drivers and shares access to the underlying hardware devises with virtual drivers. Device emulation and VM management are handled by a modified version of QEmu running in user space. 9

10 Virtualization Modes Objective 1 10

11 Full-virtual Virtualization Modes VMs can run native (unmodified) OS Requires the need to trap and emulate all privileged instructions*, or emulate everything Performance is negatively impacted KVM Requires a VT enabled CPU KVM is natively a full-virtual hypervisor Apps Operating System Virtual Machine (full-virtual) Apps Operating System Virtual Machine (full-virtual) Virtualization Layer *Some processors are difficult to fully virtualize such as traditional x86 HW Platform KVM is natively a full-virtual hypervisor but does not support native paravirtualization like Xen. KVM is really only the kernel space component with the virtualized hardware component being handled by a modified version of Qemu and virtio. Qemu can only provide hardware emulation where virtio can provide paravirtual hardware. 11

12 Virtualization Modes Progressive Paravirtual Hybrid of Full and Paravirtualization OS is Enlightened to know about paravirtual hypercalls Some parts of the OS can use paravirtual hypercalls other parts must use trap and emulation Performance is improved Requires VT enabled CPU Linux can run progressively paravirtual in KVM if the kernel was compiled with Paravirtual Operations (PV-ops) Apps Operating System Virtual Machine (full-virtual) Virtualization Layer HW Platform Apps Operating System Virtual Machine (enlightened) PV API In a progressively paravirtual machine, both hardware emulation and paravirtual APIs are provided. Depending on the operating system running in this type of virtual machine, one or both types of hardware interaction may be used. Operating systems generally start booting using the hardware emulation but switch over to using the paravirtual APIs when they are detected. The paravirtual APIs that are exposed into a progressively paravirtual machine can differ depending on the virtualization platform. KVM exposes the generic paravirtual API of the Linux kernel named Paravirt-ops (PV-ops). With the VMware hypervisor, these paravirtual APIs are named VMI and also leverage the Paravirt-ops in the Linux kernel. In the case of the Xen hypervisor, an adapter has been created that translates the native Xen paravirtual APIs into Hyper-V paravirtual APIs which are then exposed into the virtual machine. The native Xen APIs are not exposed into the VM however. The native Xen APIs are not needed because anything ported to the Xen hypervisor, can run in a native paravirtual machine. The Hyper-V hypervisor has a similar adapter that translates its native paravirtual APIs into the Xen APIs and exposes both the Xen and its native paravirtual APIs into the VM. 12

13 CPU Virtualization Objective 1 13

14 CPU Virtualization Privileged Rings Traditional Hypervisor OS Kernel and parts of the Hypervisor run in Ring 0 Ring 0 and 1 of the VM are emulated in Ring 1 virtual machine Ring 3 Ring 2 Ring 1 App App Emulated Ring 1 OS Kernel Emulated Ring 0 Virtualization Management HW Virtualization Ring 0 Hypervisor Linux Kernel Hardware I/O In traditional hypervisors, the kernel and parts of the hypervisor are loaded into Ring0, or the ring of greatest privilege. Ring 0 and Ring 1 of the virtual machine are often emulated in the real Ring 1 by the hypervisor, while Rings 2 & 3 of the VM run in the real Rings 2 & 3. Emulation of rings ) & 1 requires extra code and complexity in the hypervisor and possibly overhead in performance. 14

15 CPU Virtualization: VT vs Non-VT Pseudo Privileged Rings Full-virtual OS VT CPUs create pseudo privileged rings into which KVM creates a virtual machine virtual machine Ring 3 libvirt qemu-kvm qemu-dm/virtio App App Pseudo Ring 3 Ring 2 Ring 1 Pseudo Ring 2 Pseudo Ring 1 Ring 0 Linux Kernel KVM I/O Hardware (VT Enabled) I/O Emulation OS Kernel Pseudo Ring 0 KVM virtual machines require the VT extensions available in modern CPUs (both Intel and AMD). When creating a virtual machine, the KVM hypervisor, being prompted by qemu-kvm, requests that the VT enabled CPU create a pseudo set of privileged ring. KVM the creates the virtual machine in these rings. The kernel of an OS running in this type of VM is loaded into memory and executed in this new pseudo Ring0. All interactions with hardware are then mediated by the KVM and the Linux kernel running in the real Ring0. Leveraging the VT instructions in the CPU allows the hypervisor to be les complex and offload some of the virtualization workload to the hardware. 15

16 KVM vhost Boot Process Objective 1 16

17 Native OS Boot Process Native OS Boot Process Step 1 Boot Loader loads OS Kernel into in Ring 0 kvm and platform specific kvm_ kernel modules load Ring 3 Ring 2 Ring 1 Ring 0 Linux Kernel kvm.ko kvm_???.ko Hardware Just like traditional OSes, the first phase of the boot process is to load the kernel into Ring0 and have it initialize all of the hardware.. KVM is not a separate binary from the Linux kernel as is the case with the Xen hypervisor The kvm.ko kernel module loads causing the platform specific (Intel vs AMD) kvm kernel module to load (kvm_intel.ko or kvm_amd.ko). The Linux kernel can now act as a hypervisor. 17

18 Native OS Boot Process Native OS Boot Process Step 2 OS Kernel run in Ring 0 The libvirt daemon starts in user space (Ring 3) Ring 3 App App libvirtd Ring 2 Ring 1 Ring 0 OS Kernel Hardware The second phase of the boot process is to load the virtualization management services (libvirt) along with any other applications into Ring3. The interface for managing the Linux/KVM hypervisor is now in place and virtual machines can be launched. 18

19 KVM vhost Boot Process Objective 1 19

20 Full-virtual Machine Boot Process VM Boot Process: Step 1 The VM's configuration file is read by libvirt Libvirt formulates a qemu-kvm command that begins the VM creation process vhost Config File libvirt qemu-kvm virtio qemu-dm KVM Hypervisor Hardware Notes: 20

21 Full-virtual Machine Boot Process VM Boot Process: Step 2 The hypervisor first requests a new set of pseudo rings from the VT enabled CPU vhost Virtual Machine Config File libvirt qemu-kvm virtio qemu-dm Pseudo Ring 3 Pseudo Ring 2 Pseudo Ring 1 KVM Hypervisor Pseudo Ring 0 Hardware Notes: 21

22 Full-virtual Machine Boot Process VM Boot Process: Step 3 A virtual machine is created in the new pseudo set of rings based on the parameters in the VM's configuration At this point the VM is in a paused state vhost Virtual Machine Config File libvirt qemu-kvm virtio qemu-dm Pseudo Ring 3 Pseudo Ring 2 Pseudo Ring 1 KVM Hypervisor Pseudo Ring 0 Hardware Notes: 22

23 Full-virtual Machine Boot Process VM Boot Process: Step 4 The qemu-dm and virtio set up the virtuaized hardware layer The qemu-kvm unpauses the VM into real mode A virtual BIOS is loaded into the VM by the qemu-dm and runs, discovering all virtual/physical hardware vhost Virtual Machine Config File libvirt qemu-kvm virtio qemu-dm Pseudo Ring 3 Pseudo Ring 2 Pseudo Ring 1 KVM Hypervisor Pseudo Ring 0 Hardware Virtual Hardware Virtual BIOS Notes: 23

24 Full-virtual Machine Boot Process VM Boot Process: Step 5 The virtual BIOS loads the boot loader from the MBR/boot sector of the disk into the VM's memory vhost Virtual Machine Config File libvirt qemu-kvm virtio qemu-dm Pseudo Ring 3 Pseudo Ring 2 Pseudo Ring 1 KVM Hypervisor Hardware Boot loader Virtual Hardware Virtual BIOS Pseudo Ring 0 Notes: 24

25 Full-virtual Machine Boot Process VM Boot Process: Step 6 The boot loader loads the kernel of the OS into the VM's memory and the kernel initializes the virtual/physical hardware and switches to protected mode The OS continues to boot as normal in the VM vhost Virtual Machine Config File libvirt App App Pseudo Ring 3 qemu-kvm virtio qemu-dm Pseudo Ring 2 Pseudo Ring 1 KVM Hypervisor Hardware OS Kernel Boot loader Virtual Hardware Virtual BIOS Pseudo Ring 0 Notes: 25

26 Introduction to KVM Hardware Virtualization Objective 1 26

27 Physical Hardware Hardware CPU CPU Intel-VT / AMD-V 00: : : : : : :07.0 PCI Bus 00: : :03.0 USB Bus IO & Platform Devices (Disk, LAN, USB, BMC, IPMI, ACPI, etc.) The KVM hypervisor will run on any x86 or x86_64 hardware that has the VT extensions enabled. 27

28 KVM Virtualised Hardware KVM vhost VM Management Applications qemu-kvm qemu-dm Linux Kernel virtio / vhost KVM kvm-intel kvm-amd Physical Drivers Hardware CPU CPU Intel-VT / AMD-V 00: : : : : : :07.0 PCI Bus 00: : :03.0 USB Bus IO & Platform Devices (Disk, LAN, USB, BMC, IPMI, ACPI, etc.) The KVM hypervisor will run on any x86 or x86_64 hardware that has the VT extensions enabled. 28

29 KVM Virtualised Hardware KVM VM KVM vhost VM Management Applications qemu-kvm CPU CPU App App App Virtual Drivers 00: : : : :05.0 OS Kernel Physical Drivers 01: :01.0 PCI Bus(es) 01: : : : :04.0 USB Bus qemu-dm Linux Kernel virtio / vhost KVM kvm-intel kvm-amd Physical Drivers Hardware CPU CPU Intel-VT / AMD-V 00: : : : : : :07.0 PCI Bus 00: : :03.0 USB Bus IO & Platform Devices (Disk, LAN, USB, BMC, IPMI, ACPI, etc.) The Qemu-dm manages all hardware emulation. The virtio or vhost subsystem provides an optimized (paravirtual) I/O path for the virtual machines. 29

30 KVM Physical Hardware Passthrough KVM VM KVM vhost VM Management Applications qemu-kvm CPU CPU App App App Virtual Drivers 00: : : : :05.0 OS Kernel Physical Drivers 01: :01.0 PCI Bus(es) 01: : : : :04.0 USB Bus qemu-dm Linux Kernel virtio / vhost KVM kvm-intel kvm-amd Physical Drivers IOMMU (AMD-Vi / VT-d) Hardware CPU CPU Intel-VT / AMD-V 00: : : : : : :07.0 PCI Bus 00: : :03.0 USB Bus IO & Platform Devices (Disk, LAN, USB, BMC, IPMI, ACPI, etc.) The Qemu-dm also handle all physical device passthrough. PCI device passthrough also requires IOMMU to be enabled in the chipset. KVM supports PCI virtual function passthrough in the same manner as physical device passthrough if the device (i.e. NIC) have SR-IOV support. SR-IOV also requires IOMMU support in the chipset. 30

31 KVM OS and Feature Support Objective 1 31

32 Hardware Support / Requirements Linux/KVM Hypervisor Memory and CPU Support VM Server Limits x86* x86 PAE* x86_64 CPUs Physical Memory 512MB 4GB 512-MB-64GB 512MB-16TB VM Memory and CPU Support (Supported by SUSE) VM Server Limits x86* x86 PAE* x86_64 VCPUs per VM Memory per VM 128MB 2GB 128-MB-16GB 128MB-32GB *Only the x86_64 version of KVM will be supported by SUSE 32

33 OSes Supported by SUSE Running in a KVM Virtual Machine Supported* on KVM: SLES10 (latest SP) SLES11 (latest SP) SLES 9 (latest SP) RHEL 4 & 5 (& 6?) Windows Server 2003 & 2003R2 Windows Server 2008 & 2008R2 Windows 2000 Server Windows XP Windows Vista Windows 7 * See /usr/share/doc/packages/kvm/kvm-supported.txt for the lastest information about supported OSes Notes: 33

34 LAB 1-1: Install a Virtualization Host Server Summary: In this exercise, you install the packages requires to have a KVM virtualization host server. Special Instructions Use the following values in the exercise: (none) Duration:? min. machine Lab Notes: 34

35 Advancements in Virtualization with SUSE Linux Enterprise 11 SP2 SUS01: KVM Section 2: Introduction to Virtual Machines 35

36 Objectives The Anatomy of a Virtual Machine Xen Virtual Machine Configuration Information KVM Virtual Machine Configuration Information Introduction to Virtual Disks 36

37 The Anatomy of a Virtual Machine Objective 1 37

38 The Anatomy of a VM What makes up a Virtual Machine? Configuration For the VM server to launch a VM, it must know the parameters to use when launching the VM Disk(s) The VM's disk(s) store the OS and data used by the VM The VM's disk(s) can be simple disk images or physical disks Snapshots / Checkpoint files / etc. Notes: 38

39 KVM Virtual Machine Configuration Information Objective 1 39

40 KVM VM Configuration Information 2 Ways to Store VM Configuration Unmanaged VMs VMs require a VM configuration file to be launched The configuration file can exist anywhere on disk (recommended to be in same directory as disk image) Managed VMs VMs have a copy of their configuration file stored in the libvirt database (/etc/libvirt/qemu/) VM configuration information exists only in the Libvirt database of the vhost on which they have been installed or are running Notes: 40

41 KVM VM Configuration Information Example: XML VM Configuration <domain type= kvm id= -1 > <name>vm1</name> <memory>52428</memory> <maxmem>1024</maxmem> <vcpus>1</vcpus> <uuid>3e2ba59a-1ce e13-3b1ec2d363f2</uuid> <on_crash>destroy</on_crash> <on_reboot>restart</on_reboot> <on_poweroff>destroy</on_poweroff> <bootloader> /usr/lib/xen/boot/domuloader.py</bootloader> <bootargs> --entry=xvda2:/boot/vmlinuz-xen,/boot/initrd-xen</bootargs> <os> <type arch='x86_64' machine='pc'>hvm</type> <boot dev='hd' /> </os> <devices> <input type= mouse bus='xen'/> <graphics type= vnc port='-1'/> <interface type= ethernet > <target dev='vif-1.1'/> <mac addres='00:16:3e:3d:8f:a6'/> </interface> <disk type='file' device='disk'> <driver name='file'/> <source file='/var/lib/xen/images/vm1/disk0.img'/> <target dev='xvda'/> </disk> </devices> </domain> Notes: 41

42 Introduction to Virtual Disks Objective 1 42

43 Virtual Disks Virtual Disk Types Physical Disks Any block device in /dev Disks Partitions Logical volumes Disk Images raw disk images ISO images Qemu qcow2 VMware vmdk Microsoft vhd SAN Disks iscsi NPIV Fibre Channel Notes: 43

44 Advancements in Virtualization with SUSE Linux Enterprise 11 SP2 SUS01: KVM Section 3: Introduction to Open Source Virtualization Management 44

45 Objectives Virtualization Management Layers and Virtualization Platform Stacks Virtual Machine Management Tools Virtual Machine Creation with vm-install Notes: 45

46 Virtualization Management Layers and Virtualization Platform Stacks Objective 1 46

47 Virtualization Management Layers Identity Data Center Automation Virtualization Management Hypervisor Management Virtualized Hardware Hypervisor Identity: This is the layer where identity, authentication for and secure communication with the virtualization management utilities is administered. Data Center Automation: This is the layer that higher level utilities that help automate the virtualization stack and virtual machines running on that stack function. Tasks such as providing high availability, automatic migration based on system utilization, and virtual machine lifecycle management happen here. Virtualization Management: This is the layer that utilities that manage the virtualization stack as a whole function. Tasks such as starting and stopping virtual machines from stored configuration, viewing the status of virtual machines, connection to and managing virtual machines and delegation of such tasks happen here. Hypervisor Management: This is the layer where low level utilities that interact with and manage the hypervisor and virtualized hardware function. The low level task such as domain (virtual nachine) creation and destruction, domain suspend, resume and migration and virtual device creation, attaching and detaching happen here. Virtualized Hardware: This is the layer where the subsystems that virtualize or emulate the hardware for a virtaul machine function. Tasks such as block and network I/O virtualization and PCI bus and device emulation happen here. 47

48 Hypervisor: This layer is where the entity that does the actual virtualizarion functions. Tasks such as CPU virtaulization and memory management happen here. 48

49 Virtualization Management in SLE11-SP2 Identity OpenLDAP+Kerberos DC Automation SLE-HAE Virtualization Mgmnt xm sudo xl Policykit vm-install virsh virt-man virt-viewer libvirt-cim libvirtd libvirt Xen xenlight QEmu-KVM... Hyp Mgmnt Virt HW xend xen bus qemu-dm libxenlight xen bus qemu-dm qemu-kvm qemu-dm virtio Hypervisor Xen KVM Notes: 49

50 KVM Virtualization Stack - Details Identity Virtualization Mgmnt Datacntr automatn Hyp Mgmnt Virt HW Hypervisor LDAP / Kerberos / SSL corosync / pacemaker Bash Utilities/ GNU Tools sudo ssh TLS Policykit libvirtd libvirt libvirt -cim virtio/vhost Linux Kernel qemu-kvm KVM kvm-intel kvm-amd Hardware Identity: The components in the Identity Layer provide secure authentication and verification of identity in the virtualization management environment. LDAP is used to store user information such as user and group ID, home directory, group membership, etc. and Kerberos is used for secure authentication. An advantage of Kerberos is that other parts of the virtualization management stack such as SSH and libvirtd are kerberized (Kerberos enabled). SSL can also be used for secure authentication with server and client certificates. Datacenter Automation: Components of the SLE HA Extension such as Corosync, Pacemaker and Resource Agents provide Datacenter automation. The SUSE Linux Enterprise High Availability Extension proves the main components for this layer such as Corosync, Pacemaker, Resource Agents, etc.. Virtualization Management / Hypervisor Management: The Hypervisor/Virtualization Management Layer contains the tools and utilities used to actually administer the hypervisor and virtual machines. The Bash shell is listed as a virtualization management tool because it is the most basic way of interacting with the vhost system Shell scripts can be written to perform or automate virtualization administration tasks. Bash is also the tool that will most likely be used to execute the other virtualization management tools. For example, when you log in locally or when the SSH protocol is used to perform remote administration, a Bash shell is invoked ans used to execute these other tools. Shell aliases can also be created based on identity that when combined with the privilege delegation performed by sudo, can provide a form of role based access control. 50

51 Along with the Bash shell, many other common Linux utilities that are standard on most Linux system can also be used in virtualization management. For example, the screen utility can be used to execute tasks in parallel that are disconnected with the session and utilities such as sed, awk, cut, grep, etc. can be used to edit configuration and gather information. Libvirt provides a virtualization abstraction API that allows you to use its associated utilities (virsh, virtmanager,virt-viewer, etc.) to manage virtualization in a hypervisor agnostic manner. Qemu provides both a virtualized hardware layer for a virtual machine and is what actually invokes a KVM virtual machine. Qemu is generally not executed directly by an administrator but is rather executed by higher level API layers such as libvirt. There are components in the Virtualization Management layer allow for secure and efficient communication with the vhost. OpenSSH by nature provides a secure and flexible communication channel that is linked to identity. OpenSSH can provide for its own secure passwordless authentication using PKI and it can also use Kerberos to provide the secure passwordless authentication. OpenSSH also encrypts the communication channel allowing for true secure communication. Another advantage of the SSH protocol is that it can be used for remote execution This allows the application used to manage virtualization such as libvirt based utilities, to be executed remotely The libvirt daemon (libvirtd) provides another method of interacting with libvirt remotely. For authentication, libvirtd can use Kerberos+GSS-API for secure passwordless authentication and session encryption, it can also use TLS for session encryption. Libvirt-cim provides n interface to libvirt via the CIM protocol. There are also components in the Virtualization Management layer allow you to delegate the virtualization administration tasks on a per task, per user/group basis. PolicyKit is a new method of delegation of privilege that uses D-bus. PolicyKit allows delegation of privilege on a per-action basis instead of a per application basis. Currently you can only delegate these actions to individual users. Delegating actions to a group is not yet supported. The traditional method of delegation of privilege in the Linux world, sudo, can also be used. Sudo allows for the delegation of privilege on a per application basis and privilege can be delegated to both users and groups. When combined with shell aliases that are assigned based on identity, a form of role base access control can be enabled. Virtualized Hardware: The Virtualization Hardware Layer provides the virtual and emulated hardware devices that are presented to the virtual machines. Qemu provides an emulated hardware layer for a virtual machines presenting both a PCI bus and devices on the PCI bus. Kernel modules loaded into the Linux kernel provide paravirtualized devices presented by virtio and vhost. Hypervisor: In the case of KVM, the Linux kernel itself is turned into the hypervisor when the KVM kernel module is loaded. Working in conjunction with Qemu, the KVM module in the Linux kernel handles the virtualization and emulation tasks that are required for a virtual machine to exist. 51

52 Virtual Machine Management Tools Objective 1 52

53 VM Management Tools Built-in Virtualization Management Tools xm / xl (Xen) vm-install (Xen & KVM) libvirt, virt-manager, virsh, virt-viewer, libvirt-cim (Xen & KVM) Red Hat/SUSE virt-manager virsh virt-viewer SUSE libvirt-cim vm-install Xensource xm xl libvirtd libvirt libxen Config File QEmu KVM xend xenstore libxenlight Notes: Xen 53

54 VM Management Tools Accessing Xen Management Tools YaST->Virtualization Notes: 54

55 Virtual Machine Creation with vm-install Objective 1 55

56 VM Management Tools Built-in Virtualization Management Tools xm / xl (Xen) vm-install (Xen & KVM) libvirt, virt-manager, virsh, virt-viewer, libvirt-cim (Xen & KVM) Red Hat/SUSE virt-manager virsh virt-viewer SUSE libvirt-cim vm-install Xensource xm xl libvirtd libvirt libxen Config File QEmu KVM xend xenstore libxenlight Xen All tools mentioned here are available in SLES11. They are simply organized here by the main developer/maintainer of the tool. 56

57 The vm-install Utility vm-install Simplified tool to create and launch installations into Xen VMs Can be used to create/install both Paravirtual and Full-virtual VMs Creates both a VM configuration file and registers the VM as a managed VM in the xenstore database Can be used to perform Physical to Virtual migrations by importing existing disks or disk image files Can be run with or without a GUI Accessible as a stand alone application, from within virt-manager or through YaST YaST->Virtualization->Create Virtual Machines Notes: 57

58 vm-install The vm-install Utility Introduction Screen vm-install OS Installation method Notes: 58

59 vm-install The vm-install Utility Choose the OS Notes: 59

60 vm-install The vm-install Utility VM Installation Configuration Summary Paravirtualized VM Notes: 60

61 vm-install The vm-install Utility VM Installation Configuration Summary Fully-virtualized VM Notes: 61

62 The vm-install Utility vm-install CLI options Example: Options -c Number of VCPUs -d Disk (<pdev>,<vdev>,r w) -m Initial amount of memory (in MB) -M Maximum amount of memory (in MB) -n Domain name --nic NIC (bridge=<bridge>,mac=<mac>,model=<model>) -v, -V v=paravirtual / V=full-virtual domain -o OS type -x Extra kernel arguments (i.e runlevel. etc.) -s Install source (URL) --config-dir= Directory to place the VM's configuration files in --background Run in background, no output (i.e. for scripting) vm-install -o sles10 -n vm1 -d /dev/sda,xvda,disk,w -d /dev/cdrom,xvdb,cdrom,r \ -m 512 -M nic bridge=xenbr3,mac=00:11:22:aa:bb:cc --background Notes: 62

63 The vm-install Utility vm-install output files and directories Files and Directories /etc/xen/vm/vm_name -Traditional VM configuration file /etc/xen/vm/vm_name.xml -vm-install answer file /var/lib/xen/images/vm_name/disk0 -Directory containing the VM's disk image file(s) /var/lib/xend/domains/vm_uuid/ -Directory containing the VM's managed configuration information /var/lib/xend/domains/vm_uuid/config.sxp -The VM's managed configuration Notes: 63

64 The vm-install Utility Automated VM installs with vm-install Installation can also be automated by using an xml answer file: Example with no autoyast file: vm-install --vm-settings=xmlfile.xml --background Example with autoyast file: vm-install --os-settings=autoinst.xml --vm-settings=xmlfile.xml --background Notes: 64

65 The vm-install Utility vm-install-jobs Tool to monitor and manage VM installation started by vm-install Examples: vm-install-jobs -l vm-install-jobs -s b73sk2 vm-install-jobs -c b73sk2 vm-install-jobs -D b73sk2 -list all vm-install jobs -show info about a vm-install job -cancel a vm-install job -delete a vm-install job Notes: 65

66 Delegate VM Installation with vm-install vm-install Requires sudo to delegate vm installation privileges Notes: 66

67 LAB 3-1: Install a SLES11 KVM Virtual Machine Summary: In this exercise you will install SLES 11 as a virtual machine in KVM. Special Instructions: INSTALL_URL=(provided by instructor) Duration: 30 min. machine Lab Notes: 67

68 Advancements in Virtualization with SUSE Linux Enterprise 11 SP2 SUS01: KVM Section 4: Manage Virtualization Platforms with Libvirt 68

69 Objectives Introduction to Libvirt Libvirt Virtualization Management Utilities Use Libvirt Virtualization Management Utilities Remotly 69

70 Introduction to Libvirt Objective 1 70

71 VM Management Tools Built-in Virtualization Management Tools xm / xl (Xen) vm-install (Xen & KVM) libvirt, virt-manager, virsh, virt-viewer, libvirt-cim (Xen & KVM) Red Hat/SUSE virt-manager virsh virt-viewer SUSE libvirt-cim vm-install Xensource xm xl libvirtd libvirt libxen Config File QEmu KVM xend xenstore libxenlight Xen All tools mentioned here are available in SLES11. They are simply organized here by the main developer/maintainer of the tool. 71

72 Introduction to Libvirt What is libvirt? libvirt is a virtualization abstraction layer that sits between the hypervisor and the management tools Provides a uniform and extensible virtualization management api Provides management interface to multiple hypervisors Xen, KVM, Qemu, VirtualBox, LCX, etc. libvirt QEmu KVM xend xenstore libxenlight Xen Notes: 72

73 Introduction to Libvirt libvirt management tools Has multiple front ends for interaction Daemon (libvirtd) GUI (virt-manager, virt-viewer) CLI (virsh) CIM (libvirt-cim) virt-manager virsh virt-viewer libvirt-cim libvirtd libvirt QEmu KVM xend xenstore libxenlight Xen Notes: 73

74 Important Files and Directories (1/4) Main Configuration Files and Directories File/Dir /etc/libvirt/ /etc/libvirt/libvirtd.conf /etc/libvirt/qemu.conf /etc/libvirt/lxc.conf /etc/libvirt/qemu/ /etc/libvirt/storage/ /var/lib/libvirt/ Description -Main libvirt configuration directory -Main configuration file for the libvirt daemon -Configuration file for the qemu driver -Configuration file for the LXC driver -Managed configuration directory for KVM VMs -Managed configuration directory for storage -Directory for transient libvirt configuration Notes: 74

75 Important Files and Directories (2/4) /etc/libvirt/ File/Dir Description qemu/autostart/ -Directory for VM's config file that are to be started automatically by libvirt qemu/networks/ -Directory for virtual network definition files qemu/networks/autostart/ -Directory for virtual network definition files that should be started automatically storage/ -Directory for storage pool definition files storage/autostart/ -Directory for storage pool definition files that should be started automatically Notes: 75

76 Important Files and Directories (3/4) /var/lib/libvirt/ File/Dir boot/ dnsmasq/ images/ libxl/ lxc/ network/ qemu/ Description -Directory for transient -Directory for virtual network DHCP leases files -named NET_NAME.leases -Generic directory for disk image files -A Libvirt storage pool is defined and active for this directory by default -Directory for transient Libxenlight files -Directory for transient LXC driver files -Directory for transient virtual network files -a copy of the network's XML config file goes here while the network is started -Directory for transient QEMU driver files -QEMU VM monitor socked files -dump, save an snapshot images Notes: 76

77 libvirtd The libvirt Daemon Provides an interface to libvirt both locally and remotely Supports remote connections via TLS, SSH or TCP via SASL Local URI: xen:///, qemu:///, etc. TLS remote URI: xen://remote_host/ qemu://remote_host/system SSH remote URI: TCP remote URI: Configuration file: /etc/libvirt/libvirtd.conf Notes: 77

78 The CIM Interface CIMOM - libvirt-cim There is a CIM provider that allows any CIMOM providing the CMPI interface to manage the Xen Hypervisor This provider implements the preliminary virtualization model being defined by the DMTF System Virtualization, Partitioning, and Clustering Work Group (SVPC WG) Notes: 78

79 Libvirt Virtualization Management Utilities Objective 1 79

80 The virsh Command What is the virsh command? Provides a CLI interface to libvirt to manage virtual machines Similar capabilities to the xm command Can connect to a remote host via a TLS or SSH tunnel Notes: 80

81 The virsh Command The virsh command syntax: Querying, Connecting & Debugging Querying virsh list List running Domains (VMs) virsh dumpxml VM_NAME List configuration for a domain in XML Other Information about VMs virsh dominfo VM_NAME or VM_ID Print information about the domain virsh domstate Returns the state of a running domain Interactive Shell virsh Launch an interactive shell that accepts virsh commands without prefacing them with virsh -'quit' exits the shell Notes: 81

82 The virsh Command The virsh command syntax: Querying, Connecting & Debugging Querying virsh list List running Domains (VMs) virsh dumpxml VM_NAME List configuration for a domain in XML Other Information about VMs virsh dominfo VM_NAME or VM_ID Print information about the domain virsh domstate Returns the state of a running domain Notes: 82

83 The virsh Command The virsh command syntax: Notes: Managing VM configuration Importing into 'xenstore' virsh define XML_CONFIG_FILE Imports a VM's config file into 'xenstore' making it a managed VM Exporting out of 'xenstore' virsh dumpxml VM_NAME > file Exports VM configuration from 'xenstore' into a file (while VM is powered off) Removing from 'xenstore' virsh undefine VM_NAME Removes a VM's information from 'xenstore' 83

84 The virsh Command The virsh command syntax: Starting VMs Starting Unmanaged VMs virsh create XML_CONFIG_FILE Launch an unmanaged VM using configuration located in a stand alone XML configuration file Starting Managed VMs virsh start VM_NAME Launch a managed VM using the VM's configuration located in 'xenstore' Notes: 84

85 The virsh Command The virsh command syntax: Stopping VMs Stopping virsh shutdown VM_NAME or VM_ID Sends the 'shutdown -h now' command to the console of a VM bringing it down softly virsh reboot VM_NAME or VM_ID Sends the 'shutdown -r now' command to the console of a VM rebooting it softly virsh destroy VM_NAME or VM_ID Immediately stops and removes a VM -like pulling the power plug Notes: 85

86 The virsh Command The virsh command syntax: VM Server Information Information about the VM Server virsh nodeinfo List information about the VM Server node virsh capabilities List information about the hypervisor and node capabilities in XML format Notes: 86

87 The virsh Command The virsh command syntax: Getting help Manual Page man virsh Quick Help virsh help The virsh manual page Detailed help on the xm command Notes: 87

88 LAB 4-1: Use Common virsh Commands Summary: In this exercise, you use common virsh commands to manage virtual machines. Special Instructions: VM1_NAME=sles11sp2-kvm VM2_NAME=w2k8r2-kvm Duration: 10 min. Lab Machine Lab Notes: 88

89 The virt-viewer Utility What is the virt-viewer utility? Virt-viewer is vnc viewer for connecting to the GUI console of VMs that is independent of virt-manager Built on the GTK vncviewer Can lock pointer into VM window Can send pre defined keystrokes into the VM Virt-viewer can connect to VMs on the local VM Server or on remote VM Servers Notes: 89

90 The virt-viewer Utility virt-viewer viewing running VMs Notes: 90

91 LAB 4-2: Use virt-viewer to Connect to a Running VM Summary: In this exercise, you use the virt-viewer utility to connec to the GUI console of a running virtual machine. Special Instructions: PV_VM_NAME=sles11sp2-xen PV_VM_CONFIG=/vmstore/sles11sp2-xen/sles11sp2-xen.xml Duration: 10 min. Lab Machine Lab Notes: 91

92 The virt-manager Utility What is virt-manager? Provides a graphical interface to libvirt to manage Xen virtual machines Start / Stop / Pause a Virtual Machine Provide an overview of the Virtual Machine Provide access to Hardware information and the ability to configure VM hardware # of VCPUs Memory allocation block devices Launch vm-install to configure / install new Xen Virtual Machines Notes: 92

93 The virt-manager Utility Virt-Manager - Host and VM View vhost List VM List Notes: 93

94 The virt-manager Utility Virt-Manager VM Details VM info (hardware, Performance, etc.) Add new hardware Notes: 94

95 The virt-manager Utility virt-manager with running VM Notes: 95

96 LAB 4-3: Use virt-manager to Manage Virtual Machines Summary: In this exercise, you use the virt-manager utility to manage local virtual machines. Special Instructions: Duration: 10 min. Lab Machine Lab Notes: 96

97 Use Libvirt Virtualization Management Utilities Remotely Objective 1 97

98 Access Libvirt Remotely Supports remote connections via TLS, SSH or TCP via SASL SSH remote URI: TLS remote URI: xen://remote_host/ qemu://remote_host/system TCP remote URI: Notes: 98

99 LAB 4-4: Configure Key based Authentication in OpenSSH Summary: In this exercise you generate a SSH keypair and then upload the public key to your lab partner's machine to allow you to log in remotly without a password or passphrase. Special Instructions: REMOTE_IP=(provided by instructor) Duration: 10 min. Lab Machine Lab Notes: 99

100 LAB 4-5: Use virsh to Connect to a Remote VM Summary: In this exercise you use the virsh utility to connect to a remote VM. Special Instructions: REMOTE_IP=(provided by instructor) VM_NAME=(provided by instructor) VM_CONFIG_FILE=(provided by instructor) Duration: 10 min. Lab Machine Lab Notes: 100

101 LAB 4-6: Use virt-viewer to Connect to a Remote VM Summary: In this exercise, you use the virt-viewer utility to connect to a remote VM. Special Instructions: REMOTE_IP=(provided by instructor) VM_NAME=(provided by instructor) VM_CONFIG_FILE=(provided by instructor) Duration: 10 min. Lab Machine Lab Notes: 101

102 LAB 4-7: Manage VMs on a Remote vhost with virt-manager Summary: In this exercise, you use the virt-manager utility to connect to the libvirt daemon on a remote vhost and manage its virtual machines. Special Instructions: VHOST_IP=(provided by instructor) Duration: 10 min. Lab Machine Lab Notes: 102

103 Advancements in Virtualization with SUSE Linux Enterprise 11 SP2 SUS01: KVM Section 5: Pause, Save and Automatically Boot KVM VMs 103

104 Objectives Pause and Save VMs Boot VMs Automatically 104

105 Pause and Save VMs Objective 1 105

106 Pause and Unpause VMs Pause/Unpause (Libvirt aka: suspend/resume) Pausing a Domain leaves the VM resident in memory but stops allocating it CPU cycles Pausing VMs is supported for both paravirtual and full-virtual domains Unpausing a Domain starts allocating it CPU cycles again Notes: 106

107 Manage VCPU Allocation The virsh Command Suspend/Resume Xen KVM virsh suspend VM_NAME virsh resume VM_NAME -Pause a VM leaving it resident in memory -Unpause a paused VM Notes: 107

108 Save and Restore VMs Saving / Restoring Saving a managed or unmanaged VM pauses it, dumps the memory image to disk, and then removes it from memory Saving requires you to specify the path to the checkpoint file in which to store the memory image Restoring a saved manged or unmanaged VM creates a new Domain container, loads the saved memory image into it, and then unpauses the Domain Restoring does not remove the checkpoint file automatically Notes: 108

109 Suspend and Resume VMs Suspending / Resuming Suspending is the same as a save but operates on managed VMs. Xen - The memory image checkpoint file is stored in the persistent set of the xenstore database: /var/lib/xend/domains/vm_uuid/checkpoint.chk KVM - The memory image file is saved here by default: /var/lib/libvirt/qemu/save/vm_name.save Resuming is the same as a restore but for managed VMs Resuming removes the checkpoint file automatically Notes: 109

110 Suspend and Resume VMs The virsh Command Save/Restore Xen KVM virsh save VM_NAME SAVE_IMAGE -Save a VM by specifying where the save image file is to be stored virsh restore SAVE_IMAGE -Restore a VM by specifying the save image file Notes: 110

111 Suspend and Resume VMs The virsh Command Managedsave/Start Xen KVM virsh managedsave VM_NAME -Save a VM with libvirt deciding where to put the save image file -Flag a managed VM as having been saved for the virsh start command virsh start VM_NAME -Resume a VM that has been flagged as having been saved virsh managedsave-remove VM_NAME -Remove a managedsave image file -Unflag a VM from being saved Notes: 111

112 LAB 5-1: Pause and Save KVM VMs Summary: In this exercise you will suspend/resume, save/restore and managedsave/start a running KVM VM. Special Instructions: VM_NAME=sles11sp1-kvm VM_DIR=/vmstore/sles11sp1-kvm/ Duration: 10 min. Lab Machine Lab Notes: 112

113 Boot VMs Automatically Objective 1 113

114 Boot VMs Automatically Xen xendomains Both unmanaged and managed domains (Xen traditional syntax only) xend Managed domains, xend only (no libxenlight/libvirt managed) libvirt-guests Both unmanaged (partial) and libxenlight/libvirt xml managed domains libvirt Managed domains, libxenlight/libvirt xml only (no xend managed) KVM libvirt-guests Both unmanaged (partial) and managed domains libvirt Managed domains only Notes: 114

115 Boot Xen VMs Automatically - libvirt-guests The libvirt-guests script is used to automatically start and stop VMs when the vhost is started/stopped Works for KVM and libxenlight Xen VMs Configuration of the libvirt-guests script is done by editing variables listed in its configuration file KVM Xen Config file: /etc/sysconfig/libvirt-guests * Recommended method for KVM and Xen with libxenlight Notes: 115

116 Boot Xen VMs Automatically - libvirt-guests /etc/sysconfig/libvirt-guests Important values: ON_BOOT start = all guests that were running on shutdown get restarted/resumed ignore = no guests that were running on shutdown get restarted/resumed (unless flagged for libvirt autostart anyway) START_DELAY This defines the amount of time in seconds to wait before each guest start ON_SHUTDOWN suspend = shutdown = SHUTDOWN_TIMEOUT This defines the amount of time in seconds to wait for a guest to stop before moving on Notes: 116

117 Boot Libvirt VMs Automatically - Managed with Libvirt KVM & Xen (w/ libxenlight) The automatic starting and stopping/suspending of domains can be performed by the Libvirt daemon Command: virsh autostart VM_NAME» Creates a symlink/copy of the VM's xml config in: /etc/libvirt/qemu/autostart/ virsh autostart --disable VM_NAME» Disables autostart of a VM * Recommended method for KVM and Xen with libxenlight Notes: 117

118 LAB 5-2: Automatically Boot KVM VMs with libvirt-guests Summary: In this exercise you will configure the vhost to automatically start and stop KVM VMs when it boots and shuts down. Special Instructions: VM_NAME=sles11sp1-kvm VM_CONFIG=/vmstore/sles11sp1-kvm/sles11sp1-kvm.xml Duration: 10 min. Lab Machine Lab Notes: 118

119 Advancements in Virtualization with SUSE Linux Enterprise 11 SP2 SUS02: Libvirt, Virtual Networks, Snapshots and Clones Section 6: Delegate Virtualization Administration 119

120 Objectives Introduction to the Delegation of Virtualization Administration Delegate Virtualization Administration with PolicyKit Delegate Virtualization Administration with UNIX Group Membership Delegate Virtualization Administration with SASL 120

121 Introduction to the Delegation of Virtualization Administration Objective 1 121

122 Delegate Virtualization Administration Xen with xm or xl Delegation can only be done via sudo Xen or KVM with Libvirt Delegation can be done via: PolicyKit UNIX group membership SASL Notes: 122

123 Delegate Virtualization Administration with Libvirt Objective 1 123

124 Introduction to PolicyKit What is PolicyKit? PolicyKit is: an application-level toolkit for defining how unprivileged processes to speak to privileged processes a framework for centralizing the decision making process for granting access to privileged operation for unprivileged applications PolicyKit specifically targets applications in rich desktop environments but also applies at the command line PolicyKit does not rely on kernel special features Notes: 124

125 Introduction to PolicyKit Traditional Methods How Can Privilege Be Granted Today? SUID/SGID su sudo No authentication required Entire application runs with privilege Root password required to authenticate Entire shell and all its child processes run with privilege User's password required to authenticate Entire application runs with privilege PolicyKit User's password required to authenticate (at login time) Only certain, requested actions of application run with privilege Methods of Granting Privilege PolicyKit With PolicyKit, the user simply logs in as them self and executes the application. Depending on what action they try to perform with the application determines whether they can actually execute the application. The application only runs (with elevated privileges) for the actions that have been allowed. Delegation of privilege requires either the explicit granting of privilege on a per action basis or root authentication when the action is being attempted. 125

126 Introduction to PolicyKit GNOME PolicyKit Authorizations - Actions Object(s) Authorizations Based on Privilege/Policy Action(s) Explicitly Granted Authorization Notes: 126

127 Delegate Virtualization Administration with PolicyKit /etc/libvirt/libvirtd.conf Notes: 127

128 Delegate Virtualization Administration with UNIX Group Membership Objective 1 128

129 Delegate Virtualization Administration with UNIX Group Membership UNIX Socket: Access Access to the UNIX socket can be limited to members of a UNIX group Can be combined with PolicyKit or SASL for authentication Notes: 129

130 Delegate Virtualization Administration with UNIX Group Membership /etc/libvirt/libvirtd.conf Notes: 130

131 LAB 6-1: Use UNIX Group Membership to Delegate VM Administration Summary: In this exercise, you use UNIX group membership to authorize a non-root user to use libvirt based VM management utilities. Special Instructions: Duration: 10 min. Lab Machine Lab Notes: 131

132 Delegate Virtualization Administration with SASL Objective 1 132

133 Delegate Virtualization Administration with SASL UNIX Socket: Auth Both Read Only and Read Write access to Libvirt can be restricted via SASL Can be combined with Delegation via UNIX group Allowed users are added to SASL database stored: /etc/libvirt/passwd.db Notes: 133

134 Delegate Virtualization Administration with SASL /etc/libvirt/libvirtd.conf Notes: 134

135 Delegate Virtualization Administration with SASL /etc/sasl2/libvirt.conf Notes: 135

136 LAB 6-2: Use SASL+Digest-MD5 to Delegate VM Administration Summary: In this exercise, you use SASL+Digets- MD5 to authenticate a non-root user to use libvirt based VM management utilities. Special Instructions: Duration: 10 min. Lab Machine Lab Notes: 136

137 LAB 6-3: Use Virt-Manager as a Nonroot User on the Local Machine Summary: In this exercise you use Virt-manager as a non-root user to manage virtual machines on the local vhost. Special Instructions: Duration: 10 min. Lab Machine Lab Notes: 137

138 Advancements in Virtualization with SUSE Linux Enterprise 11 SP2 SUS02: Libvirt, Virtual Networks, Snapshots and Clones Section 7: Manage Virtual Networks with Libvirt 138

139 Objectives Introduction to Virtual Networks Manage Virtual Networks with libvirt 139

140 Introduction to Virtual Networks Introduction to Virtual Networks 140

141 Introduction to Virtual Networks What are virtual networks? Virtual networks are networks that virtual machines are connected to Virtual networks allow virtual machines to communicate with each other and with physical machines Virtual networks are configured on the Virtualization Host machine Virtual networks can be simple bridges or complex routed environments Physical Network eth0 Virtual network vif1.0 eth0 VM vhost Notes: 141

142 Introduction to Virtual Networks How are virtual networks configured? Virtual networks are configured as bridges in the Virtualization Host machine When configuring a virtual network, you are essentially creating a network switch in vhost Virtual networks can be configured dynamically via scripts or with libvirt, or statically via configuration files Physical Network eth0 Virtual network vif1.0 eth0 VM vhost Notes: 142

143 Introduction to Virtual Networks Virtual Network Components Physical Interfaces Physical interfaces are switch ports that are connected to the physical network Because they are switch ports, these physical interfaces do not have an IP address Physical Network eth0 Virtual network vif1.0 eth0 VM vhost Notes: 143

144 Introduction to Virtual Networks Virtual network components - Bridge The bridge is the actual network switch The bridge functions at layer 2 of the OSI model and forwards frames out ports based on MAC address destination An IP address, if there is one, is configured on the bridge, causing the vhost to see and use the bridge as its network interface (as opposed to the physical interface) Physical Network eth0 Virtual network vif1.0 eth0 VM vhost Notes: 144

145 Introduction to Virtual Networks Virtual network components - VIF A vif is a virtual network interface that is a switch port a virtual machine plugs into to connect to the virtual network switch A vif is created dynamically when a VM is launched (or when a new network interface is added to a running VM), and removed when the VM is shutdown (or a network interface is removed from a running VM) Physical Network eth0 Virtual network vif1.0 eth0 VM vhost Notes: 145

146 Manage Virtual Networks with libvirt 146

147 Manage Virtual Networks with libvirt Libvirt virtual network management Libvirt has the ability to dynamically create virtual networks Virtual networks created by libvirt are not persistent unless defined and set to autostart The xml configuration for defined (persistent) virtual networks is stored in /etc/libvirt/qemu/networks/ The xml configuration for autostarted virtual networks is stored in /etc/libvirt/qemu/networks/autostart/ Libvirt can create basic, NATed, and routed virtual networks Notes: 147

148 Manage Virtual Networks with Virt-Manager Notes: 148

149 Manage Virtual Networks with Virt-Manager Notes: 149

150 Manage Virtual Networks with Virt-Manager Notes: 150

151 Manage Virtual Networks with virsh Display Network Configuration Command virsh net-list [--all --inactive] Displays a list of virtual networks virsh net-dumpxml VNET_NAME Displays the xml configuration for a virtual network Notes: 151

152 Manage Virtual Networks with virsh Create/Define Virtual Networks Command virsh net-create XML_FILE Creates a new virtual network from an xml definition file virsh net-define XML_FILE Defines but doesn't activate a new virtual network from an xml file virsh net-start VNET_NAME Starts a defined but not currently active virtual network virsh net-autostart VNET_NAME Sets a defined virtual network to start Notes: 152

153 Manage Virtual Networks with virsh Remove Virtual Networks Command virsh net-undefine XML_FILE Undefines and inactive virtual network virsh net-destroy VNET_NAME Removes a virtual network Notes: 153

154 Libvirt Virtual Network Definitions Basic Bridge: <network> <name>br0</name> <uuid>37d9af4c-464a-47bb-923d-e73edc81122f</uuid> <bridge name='' stp='off' forwarddelay='0' /> <ip address=' ' netmask=' ' /> </network> NATed Bridge: <network> <name>nat0</name> <uuid>37d9af4c-464a-47bb-923d-e73edc81122f</uuid> <bridge name='' stp='off' forwarddelay='0' /> <forward dev='eth0' mode='nat' /> <ip address=' ' netmask=' ' /> </network> Notes: 154

155 LAB 7-1: Configure a Virtual Network with libvirt Summary: In this exercise, you use libvirt to configure a virtual network. Special Instructions None Duration: 15 min. machine Lab Notes: 155

156 Advancements in Virtualization with SUSE Linux Enterprise 11 SP2 SUS02: Libvirt, Virtual Networks, Snapshots and Clones Section 8: Work with Virtual Hardware in KVM 156

157 Objectives Virtual Hardware Virtual Machine Driver Pack Introduction to Linux Control Groups (cgroups) Serial Port and Console Devices Watchdog Devices Snapshot Virtual Disk Images Shared File Systems 157

158 Manage Virtualization with SUSE Linux Enterprise Virtualization Virtual Hardware Virtual Hardware 158

159 Manage Virtualization with SUSE Linux Enterprise Virtualization Paravirtual OS vs Paravirtual Drivers Paravirtual Drivers are different than a Paravirtual OS Paravirtual drivers only provide access to paravirtualized devices such as Disk and LAN adapters enabling potently better I/O performance A paravirtual OS abstracts privileged instructions inside the OS's kernel such as the following: Control registers Page table operations Debug registers Timers Disabling interrupts etc. Notes: 159

160 Manage Virtualization with SUSE Linux Enterprise Virtualization Virtual Device Types Emulated Devices: Devices are presented to the domains on the PCI bus Qemu Device Model (qemu-dm) Paravirtual Devices: Devices are presented to the domains an a different bus KVM = Virtio / vhost Xen: Emulated Devices: Rather than write their own emulated device layer, the Xen developers chose to use the existing emulated device layer from the Qemu project. The Qemu Device Model, or qemu-dm, is a full featured emulated device layer with a wide range of emulated devices including a BIOS, network cards, and disk devices. The qemu-dm uses trap and emulation to emulate theses devices. This trap and emulation, by nature, is not super efficient and therefor I/O performance in negatively impacted when using these devices. Paravirtual Devices: Xen natively provides its own paravirtual devices and drivers for these devices. These paravirtual devices provide significantly better I/O performance than the emulated devices due to how they are architected. These paravirtual devices are able to provide near bare metal performance by using shared memory for access to I/O between the VM and the Driver Domain. The VM uses a ring buffer to communicate I/O requests with the Driver Domain using hypercalls and events rather that traditional interrupts. To understand why the paravirtual devices provide so much petter performance, it it important to understand what happens with direct (non-virtual) I/O and I/O using the emulated devices. KVM: 160

161 Manage Virtualization with SUSE Linux Enterprise Virtualization Direct I/O Application 1: Data block write Physical Device MEMORY 2: Driver copies or DMAs to physical device PHYSICAL DRIVER Direct I/O Process: 1: Application writes output to memory 2: Physical driver copies or DMAs the output to the physical device 161

162 Manage Virtualization with SUSE Linux Enterprise Virtualization Emulated I/O Application Physical Device vhost MEMORY Virtual Device Guest MEMORY PHYSICAL DRIVER 4: Copies/DMAs to physical device BACK END DRIVER 3: Picks up from virtual device PHYSICAL DRIVER Emulated I/O Process: 1: Application writes output to a memory in DomU 2: Physical driver in DomU copies or DMAs the output to the virtual (emulated) device 3: Backend driver picks up output from virtual device and writes it to memory in Dom0 4: Physical driver in Dom0 copies or DMAs output to physical device 162

163 Manage Virtualization with SUSE Linux Enterprise Virtualization Paravirtual I/O Application 4: Back end driver copies or DMAs to physical device 1: Data block write Physical Device SHARED MEMORY BACK END DRIVER 3: Update received Ring Buffer 2: Update sent FRONT END DRIVER (xenbus/virtio/vhost) Paravirtual I/O Process: 1: Application writes output to a shared memory area 2: Front end driver sends an update on the paravirtual device's ring buffer that it has granted access to the shared memory area to the back end. 3: The back end receives update from the ring buffer 4: The back end reads the output from the shared memory area and either copies the output to the memory area owned by the physical driver, or the physical driver does a DMA directly from the shared memory area. In Xen, the xenbus is technically the ring buffer used to send messages between the front and back end drivers. Each virtual device in each domain has its own ring buffer. With Virtio/Vhost (KVM) virtaul devices are presented in a similar manager as Xe's xenbus. 163

164 Manage Virtualization with SUSE Linux Enterprise Virtualization Virtual Drivers What are Virtual Drivers? Driver support for DomUs comes from one or more driver domains Driver domain is typically Dom0 Front end drivers run in the DomU and interface with OS Back end drivers run in the driver domain and interface with physical hardware Notes: 164

165 Manage Virtualization with SUSE Linux Enterprise Virtualization The Virtual Machine Driver Pack The Virtual Machine Driver Pack 165

166 Manage Virtualization with SUSE Linux Enterprise Virtualization Virtual Machine Driver Pack Provides Four Main Features: Paravirtual Drivers for Xen Drivers for Paravirtual I/O Devices Hot-plugging of Devices Memory Ballooning Safe Shutdown and Reboot from the vhost Paravirtual Drivers for KVM Drivers for Paravirtual I/O Devices (virtio/vhost) Notes: 166

167 Manage Virtualization with SUSE Linux Enterprise Virtualization LAB 8-1: Install the Virtual Machine Driver Pack for KVM Summary: In this exercise you will install the Virtual Machine Driver Pack paravirtual drivers into a KVM VM. Special Instructions VM_NAME=w2K8r2-kvm VM_CONFIG=/vmstore/w2k8r2-kvm/w2k8r2-kvm.xml VMDP_URL= ADMIN_PASSWD=p@ssw0rd (as in: p <at> s s w <zero> r d) Duration:? min. machine Lab Notes: 167

168 Manage Virtualization with SUSE Linux Enterprise Virtualization Introduction to Linux Control Groups (cgroups) Introduction to Linux Control Groups (cgroups) 168

169 Manage Virtualization with SUSE Linux Enterprise Virtualization What are Linux Control Groups? A Linux feature to provide the following for processes: Resource limiting Prioritization Accounting Isolation Control Emulated PCI Bus Notes: 169

170 Manage Virtualization with SUSE Linux Enterprise Virtualization How to use CGroups with Virtualization Libvirt has built-in support for putting itself into a CGroup Libvirt drivers can have support for putting their managed objects into CGroups LXC and QEMU drivers currently support this Emulated PCI Bus Notes: 170

171 Manage Virtualization with SUSE Linux Enterprise Virtualization CGroup Configuration Main CGroup daemon (cgconfig) configuration: /etc/cgconfig.conf group virt { memory { memory.limit_in_bytes = 7500; } } mount { cpu = /dev/cgroups/cpu; cpuacct = /dev/cgroups/cpu; memory = /dev/cgroups/memory; devices = /dev/cgroups/devices; } Emulated PCI Bus Notes: 171

172 Manage Virtualization with SUSE Linux Enterprise Virtualization CGroup Configuration CG Rule Daemon (cgred) configuration /etc/cgrules.conf root:libvirtd memory virt/ Emulated PCI Bus Notes: 172

173 Manage Virtualization with SUSE Linux Enterprise Virtualization LAB 8-2: Enable and Configure Linux CGroups Summary: In this exercise you Enable and Configure Linux CGroups Special Instructions (none) Duration:? min. machine Lab Notes: 173

174 Manage Virtualization with SUSE Linux Enterprise Virtualization Serial Port and Console Devices Serial Port and Console Devices 174

175 Manage Virtualization with SUSE Linux Enterprise Virtualization User Input/Output Devices Serial Port KVM Virtual Machines Serial port(s) can be passed through to a KVM VM > Typically used for debugging purposes XML config file syntax (physical device): KVM <serial type='dev'> <source path='/dev/ttys0' /> <target port='0' /> </serial> <console type='dev'> <source path='/dev/ttys0' /> <target port='0' /> </console> Serial ports in the vhost can be mapped into virtual serial ports in the VMs. This is typically only done in cases where debug information is needed to be captured form a serial port. 175

176 Manage Virtualization with SUSE Linux Enterprise Virtualization Xen (HVM) KVM User Input/Output Devices Console KVM & Xen () - How Console Output is Handled Serial Console > A serial port must be added to the VM > The serial console must be enabled in the /etc/inittab and /etc/securetty files Example: Xen (HVM) da51:~ # virsh console sles11 Welcome to SUSE Linux Enterprise Server 11 (i586) - Kernel (xvc0). sles11 login: Only paravirtual machines have access to the virtual console. Due to limitations in the qemu-dm, the console device is not exposed to the OSes running in full-virtual machines. The virtual console should be treated in most cases like a serial console. When first attaching to the console, you must press Enter to get the console to display output to you. 176

177 Manage Virtualization with SUSE Linux Enterprise Virtualization User Input/Output Devices Console Xen (HVM) KVM & Xen () - Virtual Machines A serial device must be configured as the console > In a Linux VM, it must be enabled in /etc/inittab and /etc/securetty > inittab: S0:1234:respawn:/sbin/agetty -L 9600 ttys0 vt102 XML Config File Syntax: Xen (HVM) KVM <serial type='pty'> <source path='/dev/pts/2' /> <target port='0' /> <alias name='serial0' /> </serial> <console type='pty'> <source path='/dev/pts/2' /> <target port='0' /> <alias name='serial0' /> </console> Only paravirtual machines have access to the virtual console. Due to limitations in the qemu-dm, the console device is not exposed to the OSes running in full-virtual machines. The virtual console should be treated in most cases like a serial console. When first attaching to the console, you must press Enter to get the console to display output to you. 177

178 Manage Virtualization with SUSE Linux Enterprise Virtualization User Input/Output Devices Console Xen KVM (PV) Commands Connect to the Console > Connect to the console of a running VM KVM virsh console VM_Name or VM_ID > Detach from the console ctrl+] (control + right square bracket) Only paravirtual machines have access to the virtual console. Due to limitations in the qemu-dm, the console device is not exposed to the OSes running in full-virtual machines. The virtual console should be treated in most cases like a serial console. When first attaching to the console, you must press Enter to get the console to display output to you. 178

179 Manage Virtualization with SUSE Linux Enterprise Virtualization LAB 8-3: Enable a Serial Console in a Full-virtual Machine Summary: In this exercise, you enable a serial console in a full-virtual machine Special Instructions Use the following values in the exercise: VM_NAME=sles11sp1-kvm VM_CONFIG=sles11sp1-kvm.xml VM_DIR=/vmstore/sles11sp1-kvm/ Duration: 10 min. Lab Notes: 179

180 Manage Virtualization with SUSE Linux Enterprise Virtualization Watchdog Devices Watchdog Devices 180

181 Manage Virtualization with SUSE Linux Enterprise Virtualization Watchdog Devices Xen (HVM) KVM & Xen () - Virtual Machines A watchdog device can be presented to a VM > Supported models:» i6300esb - emulates PCI Intel 6300ESB (recommended)» ib700 - emulates ISA ibase IB700 > Supported actions:» reset = forceful reset of VM (default) Xen (HVM) KVM» shutdown = graceful shutdown of VM» poweroff = forceful power off of VM» pause = pause the VM» none = do nothing» dump = automatically dump the VM XML Config File Syntax: <device'> <watchdog model='i6300esb' action='poweroff' /> </device> Notes: 181

182 Manage Virtualization with SUSE Linux Enterprise Virtualization LAB 8-4: Configure a Virtual Watchdog Device Summary: In this exercise, you enable a serial console in a full-virtual machine Special Instructions Use the following values in the exercise: VM_NAME=sles11sp1-kvm VM_CONFIG=sles11sp1-kvm.xml VM_DIR=/vmstore/sles11sp1-kvm/ Duration: 10 min. Lab Notes: 182

183 Snapshot Virtual Disk Images 183

184 Snapshot Virtual Disk Images QCOW2 and VHD files can be snapshotted using the vm-snapshot-disk command Syntax: Create Snapshot vm-snapshot-disk create disk=<disk_file> Create a new snapshot branch vm-snapshot-disk branch disk=<disk_file> snapname=<snap_name> Revert to a snapshot vm-snapshot-disk revert disk=<disk_file> snapname=<snap_name> Remove all snapshots of a disk vm-snapshot-disk remove disk=<disk_file> Notes: 184

185 LAB 8-5: Snaphot a QCOW2 Virtual Disk Summary: In this exercise, you snapshot a qcow2 disk image. Special Instructions Use the following values in the exercise: VM_NAME= VM_DIR= DISK_IMAGE= Duration: 10 min. machine Lab Notes: 185

186 Manage Virtualization with SUSE Linux Enterprise Virtualization Shared File Systems VBD Backing Devices - Network / SAN Devices 186

187 New Features of Virtualization in SUSE Linux Enterprise 11 SP2 New VirtFS Option for Virtual Storage Allows for part of the vhost's file system to be shared with the guest Significantly better performance than disk images Uses the Plan9 protocol to communicate between host and guest Uses VirtIO for transport between Host and Guest

188 New Features of Virtualization in SUSE Linux Enterprise 11 SP2 VirtFS Internals VirtIO Ring VirtFS Client Guest OS Kernel Guest Application VFS Interface VirtFS Server p9 server in QEMU VFS Interface Cluster FS API Cluster FS File System Driver(s) Hardware Host OS Kernel/Hypervisor

189 New Features of Virtualization in SUSE Linux Enterprise 11 SP2 LAB 8-6: Configure a Shared Filesystem with VirtFS Summary: In this exercise, you configure a shared file system with VirtFS. Special Instructions Use the following values in the exercise: (none) Duration:? min. machine 189

190 190

191 UnpublishedWorkofSUSE.AlRightsReserved.Thisworkisanunpublishedworkandcontainsconfidential,proprietary,andtradesecretinformationofSUSE.AcestothisworkisrestrictedtoSUSEemployeswhohaveanedtoknowtoperformtaskswithinthescopeoftheirasignments.Nopartofthisworkmaybepracticed,performed,copied,distributed,revised,modified,translated,abridged,condensed,expanded,colected,oradaptedwithouthepriorwritenconsentofSUSE.Anyuseorexploitationofthisworkwithoutauthorizationcouldsubjectheperpetratortocriminal andciviliability.generaldisclaimerthisdocumentisnotobeconstruedasapromisebyanyparticipatingcompanytodevelop,deliver,ormarketaproduct.itisnotacomitmentodeliveranymaterial,code,orfunctionality,andshouldnotberelieduponinmakingpurchasingdecisions.susemakesnorepresentationsorwarantieswithrespectothecontentsofthisdocument,andspecificalydisclaimsanyexpresorimpliedwarantiesofmerchantabilityorfitnesforanyparticularpurpose.thedevelopment,release,andtimingofeaturesorfunctionalitydescribedforsuseproductsremainsathesolediscretionofsuse.further,susereservestherightorevisethisdocumentandtomakechangestoitscontent,atanytime,withoutobligationtonotifyanypersonorentityofsuchrevisionsorchanges.al SUSEmarksreferencedinthispresentationaretrademarksoregisteredtrademarksofNovel,Inc.intheUnitedStatesandothercountries.Al third-partytrademarksarethepropertyoftheirespectiveowners. 191